CVE-2017-6883
The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image.
Does this matter?
Lower severity and a low EPSS score (3.38%). Track it; it rarely justifies an emergency change on its own.
Description
The ConvertToPDF plugin in Foxit Reader before 8.2.1 and PhantomPDF before 8.2.1 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF image. The vulnerability could lead to information disclosure; an attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process.
- CVSS 3.0
- 4.7 MEDIUMCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 3.38% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- foxitsoftware/foxit reader · foxitsoftware/phantompdf
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/96870
- http://www.zerodayinitiative.com/advisories/ZDI-17-133/Third Party Advisory, VDB Entry
- https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
- http://www.securityfocus.com/bid/96870
- http://www.zerodayinitiative.com/advisories/ZDI-17-133/Third Party Advisory, VDB Entry
- https://www.foxitsoftware.com/support/security-bulletins.phpPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.